N-able N-central RCE flaw actively exploited
A pre-auth remote code execution flaw in N-able N-central (CVE-2026-86218, CVSS 10.0) is being actively and successfully exploited in the wild.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-86218 as exploited in the wild.
NCSC-NL issued a high-priority advisory for a critical static code injection vulnerability in N-able N-central, a widely used remote monitoring and management (RMM) platform, affecting all on-premises installations running versions prior to 2026.3.1.14. The flaw allows an unauthenticated remote attacker to execute arbitrary code on the affected system with no authentication required, making it a fully pre-auth RCE with a maximum CVSS v4 score of 10.0.
N-able initially reported exploitation attempts and has since confirmed successful exploitation against customers, indicating this moved from attempted to confirmed compromise. N-able is actively investigating incidents and working directly with affected customers. Given N-central's role as centralized management infrastructure for MSPs and IT departments, successful compromise could provide attackers a foothold to pivot into managed client environments, making this a significant supply-chain-adjacent risk.
On-premises customers are urged to upgrade immediately to N-central 2026.3 HF4. Hosted (NCOD) instances have already been patched by N-able and require no customer action. Defenders running on-premises N-central should prioritize patching, review N-able's published IoCs, and investigate for signs of prior exploitation given confirmed in-the-wild attacks.
Mentioned in this report
Detection guidance
N-central Suspicious Process Execution from Application Pool
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects N-central application process spawning system command interpreters or reconnaissance tools without legitimate administrative context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: N-central Suspicious Process Execution from Application Pool
description: Detects N-central W3WP or related application pool processes spawning
cmd.exe, powershell.exe, or system reconnaissance utilities - indicative of post-exploitation
code execution via the pre-auth RCE vulnerability.
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|re: (?i)(w3wp\.exe|iisexpress\.exe|ncentral.*service)
Image|endswith:
- \cmd.exe
- \powershell.exe
- \whoami.exe
- \ipconfig.exe
- \tasklist.exe
- \systeminfo.exe
filter_maintenance:
CommandLine|contains:
- type NUL
- echo
- REM
User|contains: SYSTEM
condition: selection and not filter_maintenance
falsepositives:
- Legitimate administrative scripts or monitoring integrations within N-central
- Scheduled maintenance tasks executing diagnostic commands
level: high
id: 27d36ee0-5600-53fe-b2f6-eb70121b9d30
status: experimental
author: Vorant
N-central Abnormal Outbound Network Activity from Service Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects N-central service processes initiating unexpected network connections to unusual ports or external hosts, consistent with post-exploitation C2 or lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: N-central Abnormal Outbound Network Activity from Service Process
description: Detects N-central W3WP or application processes establishing outbound
network connections to non-standard ports (not 80, 443, 53) or suspicious remote
hosts after successful code injection.
tags:
- attack.t1190
- attack.command-and-control
logsource:
category: network_connection
product: windows
detection:
selection:
Image|re: (?i)(w3wp\.exe|iisexpress\.exe|ncentral.*service)
Initiated: 'true'
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
filter_selection_excluded:
DestinationPort:
- 80
- 443
- 53
- 123
- 25
- 587
- 3306
- 5432
condition: (selection and not filter_selection_excluded) and not filter_internal
falsepositives:
- Database replication to custom ports on remote servers
- Third-party plugin communications to legitimate cloud services
level: high
id: e502318a-52c9-53b4-ab77-1802a84d89f8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0342.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs